The AI RecordThreadLatest finding 21 Oct 2026Checked 26 Oct 2026

Vulnerabilities Found by AI

When have AI systems found real security flaws in widely used software, and when have serious flaws been exposed in AI products themselves? Every finding we could find, dated, labelled and linked to its source.

43verified findings

21publishers

Download the data (CSV)

Filed in AI Ethics & Safety · also in AI Benchmarks

On one timeline

One line per kind of step. Filled dots are counted; open dots are claimed, lifted or not yet in effect. Hover or tap a dot.

Found by AI21 counted · 0 other

Flaw in an AI product22 counted · 0 other

Every finding

Newest first. Each verified entry counts once; claimed entries are shown and labelled but not counted.

What counts

A finding counts when (a) the developer of an AI system or the affected vendor publishes that the AI system discovered a previously unknown vulnerability in real-world software that was then confirmed or fixed (a CVE, an advisory or a patch), or (b) a vendor, government agency or established security firm publishes a confirmed vulnerability in an AI product or model (for example prompt injection leading to data exfiltration, or remote code execution) with a CVE, advisory or fix. Each finding or batch announced together counts once. Benchmarks and competitions without confirmed real-world fixes, and unconfirmed claims, are listed under related, not counted.

21 Oct 2026
OpenAIOpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilitiesOpenAI said Calif used GPT-5.6 Sol to identify a critical flaw in PHP, under OpenAI's Patch the Planet initiative, and that Wiz independently found and reported both vulnerabilities. OpenAI said PHP's maintainers led the fixes and release.VerifiedFound by AIOfficial document →
20 Oct 2026
AnthropicAnthropic: attack surface reduction research (25 open-source projects; OpenSSH 10.5/10.6)Anthropic's Frontier Red Team had Claude review 25 open-source projects and report 493 attack-surface issues; OpenSSH changed 10.5 and 10.6 after Claude found post-quantum signature code that unauthenticated clients could reach.VerifiedFound by AIOfficial document →
2 Oct 2026
GitLabGitLab / NVD: CVE-2026-90970 (GitLab AI Gateway)GitLab fixed a flaw in its self-hosted AI Gateway where an authenticated Duo Agent Platform user could escape the prompt-template sandbox with a crafted flow configuration and run commands on the host.VerifiedFlaw in an AI productOfficial document →Archived copy
15 Jun 2026
Varonis · security-firmVaronis Threat Labs: SearchLeak (CVE-2026-42824)Varonis found a one-click chain in Microsoft 365 Copilot Search that used a crafted link to make Copilot leak emails, including one-time passcodes, calendar details and files. Microsoft fixed it before disclosure.VerifiedFlaw in an AI productOfficial document →
7 May 2026
MicrosoftMicrosoft Security Blog: When prompts become shells: RCE vulnerabilities in AI agent frameworks (CVE-2026-26030, CVE-2026-25592)Microsoft disclosed two fixed flaws in its Semantic Kernel AI agent framework where prompt injection could lead to host-level code execution or arbitrary file writes that escape a sandbox.VerifiedFlaw in an AI productOfficial document →Archived copy
21 Apr 2026
MozillaMozilla: The zero-days are numbered; MFSA 2026-30 (Firefox 150)Mozilla said Firefox 150 fixed 271 vulnerabilities found with an early version of Anthropic's Claude Mythos Preview.VerifiedFound by AIOfficial document →Archived copy
7 Apr 2026
AnthropicAnthropic: Assessing Claude Mythos Preview's cybersecurity capabilitiesAnthropic said its unreleased Claude Mythos Preview model found thousands of high- and critical-severity vulnerabilities, citing patched examples such as a 27-year-old OpenBSD TCP SACK bug, a Botan certificate-authentication bypass and FFmpeg fixes in 8.1.VerifiedFound by AIOfficial document →Archived copy
26 Mar 2026
FreeBSD ProjectFreeBSD Security Advisory FreeBSD-SA-26:08.rpcsec_gss (CVE-2026-4747)FreeBSD fixed a remote, pre-authentication stack overflow in its kernel RPCSEC_GSS code used by the NFS server, credited to Anthropic's Nicholas Carlini using Claude.VerifiedFound by AIOfficial document →Archived copy
6 Mar 2026
OpenAIOpenAI: Codex Security: now in research previewOpenAI said Codex Security (formerly Aardvark) had reported vulnerabilities in projects including OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP and Chromium, with 14 CVEs assigned.VerifiedFound by AIOfficial document →Archived copy
24 Feb 2026
MozillaMozilla Foundation Security Advisory 2026-13: Security Vulnerabilities fixed in Firefox 148Mozilla's Firefox 148 fixed 22 vulnerabilities (14 high severity) that Anthropic found using Claude Opus 4.6 over two weeks, including a WebAssembly JIT miscompilation (CVE-2026-2796) for which Claude also wrote a test exploit.VerifiedFound by AIOfficial document →Archived copy
13 Feb 2026
Cursor (Anysphere)Cursor advisory GHSA-8pcm-8jpx-hv8r / CVE-2026-26268A prompt-injected Cursor agent could write to unprotected git settings, including hooks, and escape its sandbox to run code without user interaction. Fixed in Cursor 2.5.VerifiedFlaw in an AI productOfficial document →
5 Feb 2026
AnthropicAnthropic Frontier Red Team: LLM-discovered 0-daysAnthropic said Claude Opus 4.6 had found and validated more than 500 high-severity vulnerabilities in open-source software such as GhostScript, OpenSC and CGIF, with initial patches landing.VerifiedFound by AIOfficial document →Archived copy
31 Jan 2026
OpenClaw projectOpenClaw advisory GHSA-g8p2-7wf7-98mq / CVE-2026-25253The open-source OpenClaw AI agent (formerly Clawdbot/Moltbot) trusted a gateway address from a link's query string, so one click could leak its gateway token and let an attacker run commands on the user's machine. Fixed in v2026.1.29.VerifiedFlaw in an AI productOfficial document →Archived copy
27 Jan 2026
AISLEOpenSSL Security Advisory 27 Jan 2026; AISLE: AISLE Discovered 12 out of 12 OpenSSL VulnerabilitiesAISLE said its autonomous AI analyzer found all 12 vulnerabilities fixed in OpenSSL's January 2026 security release, including a high-severity stack buffer overflow in CMS parsing that could allow remote code execution.VerifiedFound by AIOfficial document →Archived copy
22 Jan 2026
MicrosoftMicrosoft Security Update Guide / NVD: CVE-2026-21520 (Copilot Studio)Capsule Security found that text typed into a public SharePoint form could hijack a Copilot Studio agent and make it email customer data to an attacker. Microsoft patched it on 15 January 2026 and issued a CVE.VerifiedFlaw in an AI productOfficial document →
20 Jan 2026
AnthropicClaude Code advisory GHSA-jh7p-qr78-84p7 / CVE-2026-21852A malicious repository could point Claude Code at an attacker's server through a settings file, so opening the project sent the user's Anthropic API key before the trust prompt appeared. Fixed in Claude Code 2.0.65.VerifiedFlaw in an AI productOfficial document →Archived copy
14 Jan 2026
Varonis · security-firmVaronis Threat Labs: Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal DataVaronis showed that a single click on a legitimate Microsoft Copilot link with instructions in its 'q' parameter could make Copilot Personal quietly leak a user's data and conversation memory. Microsoft patched it.VerifiedFlaw in an AI productOfficial document →
17 Nov 2025
GoogleChrome Releases: Stable Channel Update for Desktop (17 Nov 2025), CVE-2025-13224Google patched a type confusion in Chrome's V8 engine reported by Big Sleep.VerifiedFound by AIOfficial document →Archived copy
30 Oct 2025
OpenAIOpenAI: Introducing Aardvark: OpenAI's agentic security researcherOpenAI announced Aardvark, a GPT-5 security agent, and said it had found and responsibly disclosed numerous vulnerabilities in open-source projects, ten of which received CVE ids.VerifiedFound by AIOfficial document →Archived copy
28 Oct 2025
GoogleChrome Releases: Stable Channel Update for Desktop (28 Oct 2025, Chrome 142), CVE-2025-12036, CVE-2025-12432, CVE-2025-12433, CVE-2025-12441Google's Chrome 142 release fixed four V8 flaws (a race, two inappropriate implementations and an out-of-bounds read) reported by Big Sleep.VerifiedFound by AIOfficial document →Archived copy
3 Oct 2025
AnthropicClaude Code advisory GHSA-4fgq-fpq9-mr3g / CVE-2025-59536A bug in Claude Code's startup trust dialog let code in a malicious project run before the user agreed to trust it. Fixed in Claude Code 1.0.111.VerifiedFlaw in an AI productOfficial document →
30 Sep 2025
Tenable · security-firmTenable Research: The Trifecta: How Three New Gemini Vulnerabilities in Cloud Assist, Search Model, and Browsing Allowed Private Data ExfiltrationTenable found three prompt-injection flaws in Google's Gemini (Cloud Assist logs, search personalization and the browsing tool) that could leak saved user data and location. Google fixed all three before disclosure.VerifiedFlaw in an AI productOfficial document →Archived copy
30 Sep 2025
GoogleChrome Releases: Stable Channel Update for Desktop (30 Sep 2025), CVE-2025-11215, CVE-2025-11219Google patched an off-by-one error and a use-after-free in Chrome's V8 engine, both reported by Big Sleep.VerifiedFound by AIOfficial document →Archived copy
30 Sep 2025
Legit Security · security-firmLegit Security: CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source CodeLegit Security showed that hidden comments in a pull request could make GitHub Copilot Chat search a victim's private repositories and leak secrets and code through GitHub's image proxy. GitHub fixed it by disabling image rendering in Copilot Chat.VerifiedFlaw in an AI productOfficial document →Archived copy
25 Sep 2025
Noma Security · security-firmNoma Labs: ForcedLeak: AI Agent risks exposed in Salesforce AgentforceNoma found that hidden instructions planted in a Salesforce Web-to-Lead form could make the Agentforce AI agent send CRM data to an attacker through an expired, still-trusted domain. Salesforce enforced trusted-URL controls on 8 September 2025 and re-secured the domain.VerifiedFlaw in an AI productOfficial document →Archived copy
23 Sep 2025
GoogleChrome Releases: Stable Channel Update for Desktop (23 Sep 2025), CVE-2025-10891, CVE-2025-10892Google patched two integer overflows in Chrome's V8 engine, both reported by Big Sleep.VerifiedFound by AIOfficial document →Archived copy
18 Sep 2025
Radware · security-firmRadware threat advisory: ShadowLeakRadware found a zero-click prompt injection in ChatGPT's Deep Research agent: a hidden instruction in an email could make the agent send the user's data to an attacker from OpenAI's own servers. OpenAI told Radware on 3 September 2025 that it had fixed it.VerifiedFlaw in an AI productOfficial document →Archived copy
26 Aug 2025
GoogleChrome Releases: Stable Channel Update for Desktop (26 Aug 2025), CVE-2025-9478Google patched a critical use-after-free in Chrome's ANGLE graphics layer that Big Sleep had reported.VerifiedFound by AIOfficial document →Archived copy
19 Aug 2025
GoogleChrome Releases: Stable Channel Update for Desktop (19 Aug 2025), CVE-2025-9132Google patched an out-of-bounds write in Chrome's V8 JavaScript engine that its Big Sleep AI agent had reported.VerifiedFound by AIOfficial document →Archived copy
12 Aug 2025
MicrosoftMicrosoft Security Update Guide / NVD: CVE-2025-53773 (GitHub Copilot and Visual Studio)A prompt injection could make GitHub Copilot in Visual Studio Code edit the project's settings to auto-approve its own actions ('YOLO mode') and then run code on the developer's machine. Microsoft fixed it in the August 2025 Patch Tuesday.VerifiedFlaw in an AI productOfficial document →
6 Aug 2025
NVIDIANVIDIA security bulletin / CVE-2025-23319 (Triton Inference Server)NVIDIA patched a flaw in the Python backend of its Triton Inference Server for AI models that let a remote attacker trigger an out-of-bounds write, which could lead to remote code execution or data disclosure.VerifiedFlaw in an AI productOfficial document →
5 Aug 2025
Check Point · security-firmCheck Point Research: Cursor IDE: Persistent Code Execution via MCP Trust Bypass (MCPoison, CVE-2025-54136)Check Point found that the Cursor AI code editor kept trusting an approved MCP configuration even after it was changed, so an attacker could swap in a malicious command that ran every time a project opened. Fixed in Cursor 1.3.VerifiedFlaw in an AI productOfficial document →Archived copy
5 Aug 2025
Cursor (Anysphere)Cursor advisory GHSA-4cxx-hrm3-49rm / CVE-2025-54135 (CurXecute)Cursor's AI agent could be steered by indirect prompt injection to create a new MCP configuration file without user approval, giving remote code execution. Fixed in Cursor 1.3.9.VerifiedFlaw in an AI productOfficial document →
15 Jul 2025
GoogleGoogle: A summer of security: empowering cyber defenders with AI (CVE-2025-6965)Google said its Big Sleep agent, working with Google Threat Intelligence, found a SQLite memory-corruption flaw that threat actors knew about and were preparing to exploit; SQLite fixed it in 3.50.2.VerifiedFound by AIOfficial document →Archived copy
9 Jul 2025
JFrog · security-firmJFrog Security Research: Critical RCE vulnerability in mcp-remote (CVE-2025-6514)JFrog found that mcp-remote, a widely used proxy that connects AI clients to remote MCP servers, could be made to run operating-system commands by a malicious MCP server. Fixed in mcp-remote 0.1.16 (CVSS 9.6).VerifiedFlaw in an AI productOfficial document →Archived copy
24 Jun 2025
XBOWXBOW: The road to Top 1: How XBOW did itXBOW's autonomous AI penetration tester reached first place on HackerOne's US leaderboard after submitting about 1,060 vulnerability reports, of which 130 were resolved by bug bounty programs.VerifiedFound by AIOfficial document →Archived copy
13 Jun 2025
Anthropic (Model Context Protocol)GitHub advisory GHSA-7f8r-222p-6f5g / CVE-2025-49596 (MCP Inspector)Anthropic's MCP Inspector developer tool lacked authentication between its client and proxy, so a malicious website could make it launch commands and achieve remote code execution on a developer's machine. Fixed in version 0.14.1; Oligo Security found it.VerifiedFlaw in an AI productOfficial document →
11 Jun 2025
MicrosoftMicrosoft Security Update Guide / NVD: CVE-2025-32711 (EchoLeak)Aim Security found 'EchoLeak', a zero-click prompt-injection flaw in Microsoft 365 Copilot that could let a crafted email make Copilot leak a user's private data to an attacker. Microsoft fixed it server-side and rated it critical (CVSS 9.3).VerifiedFlaw in an AI productOfficial document →
5 May 2025
CISA · governmentCISA: CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2025-3248)CISA added a Langflow flaw to its Known Exploited Vulnerabilities catalog: the AI-agent builder let unauthenticated attackers run arbitrary code through its code-validation endpoint, and attackers were exploiting it. Fixed in Langflow 1.3.0.VerifiedFlaw in an AI productOfficial document →Archived copy
31 Mar 2025
MicrosoftMicrosoft Threat Intelligence: Analyzing open-source bootloaders: Finding vulnerabilities faster with AIMicrosoft used its Security Copilot AI to help find 20 vulnerabilities in the GRUB2, U-Boot and Barebox bootloaders; maintainers released fixes on 18-19 February 2025.VerifiedFound by AIOfficial document →Archived copy
29 Jan 2025
Wiz · security-firmWiz Research: Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat HistoryWiz found a publicly reachable, unauthenticated ClickHouse database belonging to DeepSeek that exposed chat history, secret keys and backend details and allowed full control of the database. DeepSeek secured it after Wiz disclosed it.VerifiedFlaw in an AI productOfficial document →Archived copy
20 Nov 2024
GoogleGoogle Security Blog: Leveling Up Fuzzing: Finding more vulnerabilities with AI (CVE-2024-9143)Google's OSS-Fuzz used LLM-written fuzz targets to find 26 new vulnerabilities in open-source projects, including an out-of-bounds read/write in OpenSSL's GF(2^m) elliptic-curve code that OpenSSL fixed in October 2024.VerifiedFound by AIOfficial document →Archived copy
1 Nov 2024
GoogleGoogle Project Zero: From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World CodeGoogle's Big Sleep agent (Project Zero with Google DeepMind) found an exploitable stack buffer underflow in SQLite's development branch. SQLite fixed it the same day it was reported, before it reached an official release.VerifiedFound by AIOfficial document →Archived copy

How this thread is kept

Every entry links to the official document itself: the order, law, filing or statement, with an archived copy where one exists. Steps known only from news reports are left out, so our count can be lower than press tallies. New entries are added when we find their official text. How the Record works · Report an error or a missing finding

On one timeline

Every finding

Related, not counted